Issue #2399037 by effulgentsia: String::format() marks a resulting string as safe even when passed an unsafe passthrough argument